# Cutting CloudWatch Costs: A Simple ECS Log Optimization Strategy

Before diving into the steps, here’s a quick look at the **real CloudWatch cost reduction** I achieved after optimizing ECS logging.

## Before Optimization

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1759835378366/5beda1c0-a47b-497d-a698-166e88af6360.png align="center")

## After Optimization

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1759835402071/622abc6d-b01f-40ef-b990-985a801e67fb.png align="center")

## Step-by-Step: Disabling CloudWatch Log Collection in ECS

After identifying that CloudWatch logs were driving up the cost, I looked into where these logs were being generated i.e. **ECS Task Definition**.

ECS task streams container logs to CloudWatch using the **awslogs** driver.This is helpful for debugging but quickly becomes expensive in testing, production environments where logs are continuous.

> **Note:** Disabling CloudWatch log collection is recommended only for testing or development environments.

**Instead of sending all logs to CloudWatch**, you can use a **local log driver with rotation**.  
This approach keeps your logs available for debugging directly on the ECS host while dramatically reducing ingestion and storage costs in CloudWatch.

**Step 1: View Current Log Configuration (When Enabled)**

In the ECS console, open your cluster’s service and navigate to the **Task Definition** associated with that service. Under each container definition, you’ll see the **log collection (awslogs) option enabled**. This configuration pushes all container logs to **CloudWatch**, which can increase both log ingestion and storage costs.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1759899153113/fc692c6f-c40f-40b1-a054-4c03cd557789.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1759899190994/3752d858-20b7-4e2c-8039-c0318eb6ba3e.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1759899264727/ea83887e-bd5a-4d22-bca7-845445d7ae48.png align="center")

**Step 2: Disable the Log Configuration**

To stop unnecessary log streaming, create a **new Task Definition revision**. In your container definition, open the **Log Configuration** section, **disable the log collection option**, then **save and deploy** the new revision in your ECS service.

After deployment, you’ll notice that the **Logs tab in your ECS service now appears empty**, this is expected, as log streaming to CloudWatch has been disabled.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1759899668759/d1bd026e-3aec-425c-ac0e-4847dd168404.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1759899696674/54071ef2-292a-4614-bc58-5462956d8e72.png align="center")

## Setting Up Local Log Rotation on ECS (EC2 Hosts)

Disabling CloudWatch log collection helps reduce costs, but we still need access to container logs for **debugging and monitoring**. To handle this efficiently, we can enable **local log rotation** on the ECS host (the EC2 instance running your containers).

This ensures that container logs are stored locally on the instance and automatically rotated when they reach a certain size, preventing the disk from filling up.

### The image below shows the system logs before local log rotation

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1759901370137/6533e263-5b85-4e0e-b2d3-004335f011b9.png align="center")

To verify the logging driver used by a specific container, run the following command:

```plaintext
docker inspect -f '{{.HostConfig.LogConfig.Type}}' <container_id>

Example: docker inspect -f '{{.HostConfig.LogConfig.Type}}' 1e9c943d26d4
```

**Step 1: SSH or directly Session Connect into your ECS EC2 instance**

* **Switch to root:** `sudo su`
    
* **Go to Docker config directory:**
    
    ```plaintext
    cd /etc/docker
    pwd   # confirm path
    ```
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1759907485669/ac1f7cf6-2d4d-4132-8900-41a8e7c50d17.png align="center")
    
* **Edit daemon.json:** `vi daemon.json`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1759992658549/3f186efd-dd33-41a5-98b2-fc7e9bc22e4d.png align="center")
    
* **Add log rotation code: adjust the** `max-size` and `max-file` values based on your disk capacity and log volume requirements:
    
    ```plaintext
    {
      "log-driver": "local",
      "log-opts": {
        "max-size": "20m",  // Maximum size of a single log file (e.g., 20 megabytes)
        "max-file": "7"    // Maximum number of log files to keep
      }
    }
    ```
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1759992702326/ccadcc6e-1971-4815-9bc7-174ac2b1658c.png align="center")
    
* **Save the file and restart Docker:** `sudo systemctl restart docker`
    

**Step 2: Verify Log Rotation**

* **After implementing Step 1, verify that log rotation is active for each container:** `docker inspect -f '{{.HostConfig.LogConfig.Type}}' <container-id>`
    
    ```plaintext
    docker inspect -f '{{.HostConfig.LogConfig.Type}}' <container-id>
    Example:
    docker inspect -f '{{.HostConfig.LogConfig.Type}}' 1f9c943d25d9
    ```
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1759995546795/53909383-40f7-4ea2-8dec-ab7625a93503.png align="center")
    

This confirms that log rotation has been successfully applied and logs are ready for monitoring or debugging.

**verify the log path:**

```plaintext
sudo ls -lh /var/lib/docker/containers/<container-id>/
# or
sudo ls -lh /var/lib/docker/containers/<container-id>/local-logs/

# OR go to log path

sudo cd /var/lib/docker/containers/<container-id>/local-logs/

sudo cd /var/lib/docker/containers/<container-id>/
```

If log rotation is configured correctly, you’ll see files like:

```plaintext
container-json.log
container-json.log.1
container-json.log.2
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1759995819254/c36e6d1f-0582-4902-b9e5-3d1195cc0465.png align="center")

***The screenshot below shows an example of checking container logs:*** `docker logs <container-id>`

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1759996452859/63b63810-0fc8-4601-abb2-7a346196c729.png align="center")

***The screenshot below shows how to optimize CloudWatch log costs by configuring log group retention periods.***

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1759996865214/d690d98d-dd39-4f40-9e04-9a28b0e477d1.png align="center")

### Conclusion

By shifting non-essential ECS logs from **CloudWatch** to **local Docker rotation**, you gain immediate control over your log costs and significantly reduce your AWS bill without losing local troubleshooting capability.